CVE Vulnerability Catalog

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to and including 1.6.11.11 due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This allows unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.

The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.7.7 due to the plugin not properly verifying that a user is authorized to perform an action. This allows authenticated attackers with Contributor-level access and above to publish their own Hello+ header/footer templates and draft currently active templates owned by higher-privileged users.

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email (Contact Email custom field htmlvar_name)' parameter in all versions up to and including 2.8.188 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. Successful exploitation requires that an administrator has added and configured the Contact Email custom field to render on the public single-listing output page, and that the administrator subsequently approves the attacker's submitted listing.

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> in all versions up to and including 5.2.10 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page. The payload is not neutralized at save time because post_content stores only a benign block reference to an external feed URL; the malicious HTML is injected at render time from the attacker-controlled RSS feed title, bypassing any save-time wp_kses filtering.

The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to generic SQL Injection via FireBox Form Display Condition in all versions up to and including 3.1.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with author-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On fresh installations of version 3.1.10 and later, exploitation requires administrator-level access; however, on sites upgraded from a version prior to 3.1.10, the preserveCampaignRoleAccess() migration grants the edit_fireboxes capability to any role that previously held edit_posts, reducing the minimum required privilege to Author-level.

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'inputs (array key)' parameter in all versions up to and including 1.15.48 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Download Manager plugin for WordPress up to version 3.3.71 is vulnerable to sensitive information exposure via the 'first_name' parameter. Authenticated attackers with subscriber-level access can extract the administrator's full Cookie header, including wordpress_logged_in_* session cookies, from the suspension email sent during the administrator's authenticated request. This enables full session hijack and account takeover.

The Anti-Spam by CleanTalk plugin for WordPress up to version 6.88 is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is exploitable once a comment from the attacker's email is approved; on default WordPress installations, only the first comment from a given email is moderated, and subsequent comments auto-approve.

The Download Manager plugin for WordPress up to version 3.3.71 is vulnerable to Stored Cross-Site Scripting via the 'regurl' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page. The injected payload only fires for logged-out visitors, as the vulnerable login-form.php template branch is gated on !is_user_logged_in().

The Fluent Forms plugin for WordPress up to version 6.2.14 is vulnerable to Reflected Cross-Site Scripting via the 'any attacker-chosen name matching the {get.NAME} placeholder' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into clicking a link. Exploitation requires a site administrator to have configured a Custom HTML field on a published form containing a {get.*} SmartCode inside a URL-accepting attribute such as iframe src or a href.

The Table Field Add-on for ACF and SCF plugin for WordPress up to version 1.4.1-RC2 is vulnerable to Stored Cross-Site Scripting via Table Field Value due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access can inject arbitrary web scripts that execute when a user accesses an injected page.

The ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface.

The Bookly plugin for WordPress up to version 28.4 is vulnerable to Insecure Direct Object Reference via the 'id, wp_user_id' parameter due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access can overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges.

The Bookly plugin for WordPress up to version 28.4 is vulnerable to sensitive information exposure via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and getCodes() loads the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of customerIdentityConfirmed(). When placeholders like {client_name}, {client_email}, {client_phone}, or {client_note} are placed in the Details step's information text, the matched customer's stored data is substituted into the returned HTML.

The Advanced Classifieds & Directory Pro plugin for WordPress up to version 3.4.4 is vulnerable to Stored Cross-Site Scripting via the 'phone' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access can inject arbitrary web scripts that execute when a user accesses an injected page. The vulnerability is only exploitable on sites where the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is placed on a sidebar displayed on single listing pages; both conditions are non-default.

The Academy LMS plugin for WordPress up to version 4.0.3 is vulnerable to authorization bypass due to the plugin not properly verifying that a user is authorized to perform an action. Authenticated attackers with custom-level access can permanently delete arbitrary Academy lesson comments and their replies authored by any user, including administrators, across courses they do not instruct. The vulnerability is exploitable by any user registered as an Academy instructor for at least one course, as they can supply their own course_id to pass the instructor check while targeting comments belonging to entirely different courses.

The Academy LMS plugin for WordPress up to version 4.0.3 contains a privilege escalation vulnerability. The `add_child()` function assigns the `academy_student` role to any existing account based on the attacker-supplied `email` parameter before validating the guardian-ward relationship, and fails to roll back the role assignment when validation returns an error. This allows authenticated attackers with the `academy_guardian` role or higher to elevate any existing account, including their own, to the `academy_student` role, gaining `edit_posts` (Contributor-equivalent) capabilities and, when the student file-upload setting is enabled, `upload_files` (Author-equivalent) capabilities.

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it into the server-side shiny_bookmarks directory without validating that it is a single safe path segment. An unauthenticated request can use parent-directory segments or an absolute path to make the server open input.json and values.json outside the bookmark store, even when bookmark_store is set to disable. In applications configured with bookmark_store set to server and using ui.input_file(), the restore handler can additionally copy and expose an attacker-selected file from an attacker-selected directory. This issue is fixed in version 1.6.4.

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtr_cloud_token and @mindwtr_webdav_password. A party with access to the application database or an exposed device backup can recover these credentials and use them to access the user's synchronized tasks and attachments. This issue is fixed in version 1.1.5.

CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditClientForm performs a raw lookupAccount(accountId) without confirming that the citizen account belongs to the requester's trustedIntermediaryGroup. An authenticated Trusted Intermediary can enumerate accountId values and read the applicant display name, including the citizen's name and email address, for accounts outside the intermediary's group. This issue is fixed in version 3.33.0.